(mirror of https://github.com/vyos/vyos-github-actions.git) https://git.amelek.net/vyos/vyos-github-actions.git/atom?h=chore%2Frollout-1c-rename-refs 2026-05-30T15:20:08+00:00 2026-05-30T15:20:08+00:00 Yuriy Andamasov yuriy@vyos.io 2026-05-30T15:20:08+00:00 urn:sha1:37d0aa1ffdbfb7e71daed49ffbfa221ee816b8ae Tracking: T8943 2026-05-30T13:05:52+00:00 Yuriy Andamasov yuriy@vyos.io 2026-05-30T13:05:52+00:00 urn:sha1:c53c5a1c97332806c317451c4d86631066b0f685 Rewrites uses: pins to the three HIGH-fanout producers (vyos/.github, vyos/vyos-cla-signatures, VyOS-Networks/vyos-reusable-workflows) from their old default branch to the new production compat branch staged in Task 1. No functional change; pin-ref rewrite only. Tracking: T8943 2026-05-30T09:50:06+00:00 Yuriy Andamasov yuriy@vyos.io 2026-05-30T09:50:06+00:00 urn:sha1:cb132ecdef24ec4b5c2f275dadd7b7bb776a3d0e Replaces 5 caller workflows now superseded by central Mergify rules. See https://vyos.dev/T8937 for the design + spec + plan. Advances: T8937 🤖 Generated by [robots](https://vyos.io) 2026-05-29T23:34:08+00:00 Yuriy Andamasov yuriy@vyos.io 2026-05-29T23:34:08+00:00 urn:sha1:b5e2b170016ca3dd011df7de42ec858858564bb7 Replaces PAT-based secrets passthrough with secrets:inherit and MIRROR_ENABLED opt-out guard per rollout 1b uniform stub spec. Plan: ~/.claude/plans/2026-05-26-mirror-rollout-1b-revised.md Task 5 🤖 Generated by [robots](https://vyos.io) 2026-05-28T10:25:43+00:00 Yuriy Andamasov yuriy@vyos.io 2026-05-28T10:25:43+00:00 urn:sha1:b28c9e64fbfb91767e88cbefacd58e211c10d19e Addresses CodeRabbit finding on PR #10 (merged) — pin all three movable refs in the pull_request_target workflow to immutable commit SHAs. Defense in depth: the assign_reviewer job mints a vyos-bot[bot] App-installation token from secrets.APP_PRIVATE_KEY; movable refs in a secrets-handling pull_request_target workflow are an RCE vector if any of the referenced repos (or any user with push access to them) is compromised. Pinned refs: - toshimaru/auto-author-assign@2daaeb2 (was @v1.6.2) - vyos/.github/.github/actions/get-token@8a437c7 (was @current — vyos org-local but elevated trust workflow, so pin even our own action; trade-off: must manually bump SHA on central-action updates) - shufo/auto-assign-reviewer-by-files@f5f3db9 (was @v1.1.4) CR thread: https://github.com/vyos/vyos-github-actions/pull/10#discussion_r3316105021 Phase 0 CR: 0 finding(s). Refs: T8615 follow-up (the original CI-fix PR #10 was out-of-T8615- scope but landed in the same sweep) Generated by robots https://vyos.io 2026-05-28T10:07:50+00:00 Yuriy Andamasov yuriy@vyos.io 2026-05-28T10:07:50+00:00 urn:sha1:9139991776bf311dbc51b9f2e23d71f1d964a954 Two CI workflows in this repo have been failing on every PR for an extended period. Both surfaced during the T8615 Mergify central-config sweep against vyos/vyos-github-actions#9. unused-imports.yml ================== Workflow invoked 'make unused-imports' but this repo has no Makefile (grep across full git history confirms no Makefile ever existed). The 'unused-imports' target appears to have been copy-pasted from a sister repo (vyos/vyos-1x defines it). Workflow has been broken since the 'T6310: add PR templates' commit (d327ae1) introduced it. Fix: invoke pylint directly, enabling only W0611 (unused-import) per the workflow's original intent. Use 'git ls-files -z' + 'xargs -0' so any future Python file with whitespace in its path is handled safely. auto-author-assign.yml / assign_reviewer ======================================== The 'assign_reviewer' job authenticated via secrets.PR_ACTION_ASSIGN_REVIEWERS, a classic personal access token whose lifetime exceeds 90 days. The VyOS-Networks enterprise rejects this with: The 'VyOS Networks' enterprise forbids access via a personal access tokens (classic) if the token's lifetime is greater than 90 days. Please adjust your token's lifetime at the following URL: https://github.com/settings/tokens/1583410548 Fix: swap to a vyos-bot[bot] App-installation token minted via the central composite action at vyos/.github/.github/actions/get-token@current (established 2026-05-26 under Mirror Pipeline Rollout 1a). The minted token is scoped down to pull_requests:write only — narrower than the App's default permissions, defense in depth for the pull_request_target trigger surface. The 'assign-author' job is unchanged — it uses the default GITHUB_TOKEN and works correctly. Only the broken 'assign_reviewer' job is touched. Follow-up: the now-orphaned secrets.PR_ACTION_ASSIGN_REVIEWERS classic PAT (https://github.com/settings/tokens/1583410548) can be revoked at operator's discretion after this PR lands. Test plan ========= - Local YAML parses (verified) - Phase 0 CR clean (0 findings after applying the round-2 review suggestions about NUL-delimited xargs + removing internal docs link) - Post-merge: next PR opened against current should see both 'Check for unused imports using Pylint' and 'PR Triage / assign_reviewer' pass instead of fail Refs: T8615 (re-scoped 2026-05-28), IS-421 Caught while landing: https://github.com/vyos/vyos-github-actions/pull/9 Generated by robots https://vyos.io 2026-05-09T15:51:42+00:00 kumvijaya kumvijaya@gmail.com 2026-05-09T15:51:42+00:00 urn:sha1:432d67af55fe0e1581d90c969897ba5e17a682a5 2025-07-14T12:03:23+00:00 Yevhen Bondarenko evgeniy.bondarenko@sentrium.io 2025-07-14T12:03:23+00:00 urn:sha1:3207938c70590c01a1fc856076a171e1946a335a 2025-07-04T13:55:24+00:00 lemeshovich 17667824+lemeshovich@users.noreply.github.com 2025-07-04T13:55:24+00:00 urn:sha1:61c8920202f6b5a8f6b5eb26c128ab5ef8e1763d 2024-05-08T10:45:02+00:00 kumvijaya kumvijaya@gmail.com 2024-05-08T10:45:02+00:00 urn:sha1:84627dba07a4c0c7b4f4e791427b7ce108bf3aac